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Executive summary 


Report on Stakeholder Perceptions for the ICO 


Executive summary 


Introduction 


The Information Commissioner’s Office (ICO) commissioned Ipsos MORI to conduct 
research among key stakeholders to measure perceptions of the ICO and its performance. 
The research comprised two elements: a quantitative telephone survey with 58 stakeholders 
and qualitative depth interviews with 13 stakeholders. Fieldwork for this research took place 
between 13 December 2011 and 7 February 2012. 


This report combines the findings from both elements of the research; the key findings of 
which are summarised below. 


Overview 


It is clear from this research that the ICO is valued by stakeholders: 


= Most are advocates and believe the ICO has a real and valuable role to play in ensuring 
the success of their organisations. 


= The ICO stands out from other regulators in adopting a more pragmatic approach to 
enforcement, and this is a much valued aspect of stakeholders’ relationship with the 
ICO. However, this stance is not without its issues which are acknowledged by 
stakeholders, namely the difficult act of balancing the advisory and enforcement roles. 


= While stakeholders perceive the direct benefits of being able to get quick and informal 
answers to queries and the ICO’s willingness to take the time to learn about their 
organisations they do feel that the ICO needs to fulfil its enforcement role more. Put 
simply they feel that the ICO needs to publicise its enforcement actions more — to be 
seen to be acting as an enforcer by being more public about actions they take against 
those organisations which do not comply with legislation. 


Hence, looking back to the ICO’s vision (“by 2012 we will be recognised by our stakeholders 
as the authoritative arbiter of information rights”) gives a mixed message. The ICO is seen 
as an effective arbiter in providing advice and guidance on information rights. However 
stakeholders also see an inherent conflict between this advisory role and the ICO’s duty as a 
regulator, which is seen to constrain the ICO in both its roles. 


The wish for the ICO to be more public about the enforcement (authoritative) side of its role, 
extends outside the UK. Stakeholders see a role for the ICO as the champion of UK 
information rights compliance in Europe — publicising the high level and standard of 
compliance in the UK. They see a further role in reinforcing these messages with examples 
of good practice to showcase both current UK thinking and provide good working guidelines 
for organisations to follow. 


The two most mentioned areas for improvement would involve fundamental change to both 
the ICO’s role and information rights legislation but are perceived to offer immediate and 
valuable benefits to stakeholders. Specifically, these are: 


= The move towards a more precedent-based structure in information rights decisions — 
this is seen to offer the perceived benefit to stakeholders of reducing the amount of 
inconsistency in the decisions and advice given by the ICO and also reducing the burden 
on themselves of compliance with the legislation. It is also seen to reduce the ambiguity 
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of the ICO’s role as a regulator and advisor — allowing the ICO to take a clearer stance 
on specific issues. 


= Likewise the desire for speedier advice and guidance on emerging areas of technology 
offers stakeholders the benefit of having some guidance in how to implement required 
changes within their organisation, without the need to review their procedures again 
once formal guidance is issued. Some stakeholders are willing to trade a definitive 
answer (at a later date) for “first thoughts” guidance (at an early date) to allow them to 
work from agreed principles when developing their internal procedures. Hence from the 
stakeholders’ perspective it would be feasible for the ICO to speak informally about the 
issues while formulating opinions and practices which will be incorporated into formal 
guidance later. 


Contact with the ICO 


There is clearly an established and valued contact structure in place for key stakeholders — 
most have one senior member of ICO staff as their designated contact and contact at this 
level is seen to be good. 


Stakeholders feel able to contact the ICO as and when they need to — to seek guidance on 
specific issues or to raise concerns. They clearly appreciate this ability to call on expert 
knowledge from ICO staff when needing a “sounding board” to discuss areas of uncertainty. 


Feeling informed 


Two-thirds of respondents feel they are kept informed by the ICO, although there is a feeling 
that the ICO could be communicating more with stakeholders. Among telephone survey 
respondents, the ICO’s website is the main information source and a preferred source for 
most respondents, however there are issues around the usability of the search function and 
the relevancy of some of the information stored on it. 


There is clearly an appetite for more communication with the ICO, but the established pattern 
of stakeholders contacting the ICO when they need to seems to be working well. 


Working relationship with the ICO 


The ICO clearly has very good relationships with stakeholders, being seen to work in a 
collaborative manner and acknowledging the expertise of their stakeholders. The seniority of 
their designated contacts is valued, providing gravitas to advice given and reassuring 
stakeholders that when they are signposted to other members of ICO staff their enquiries will 
be handled well. Relationships are generally seen to have either improved or stayed the 
same and stakeholders overall have very positive perceptions of the ICO staff they contact. 


The main criticism is the lack of consistency in information and advice given on specific 
topics. Experiences of more junior staff, essentially the complaint case worker level, are less 
good. The issues for stakeholders are twofold: 


= new case workers are perceived to lack knowledge of the client and established 
working practices; and 


7 inconsistencies in the advice given by different individuals on the same point of 
compliance. 
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However, for most stakeholders this is not seen as being a major problem, more a niggle or 
an irritation rather than an issue. For those depth interview participants who mention this as 
an issue better internal ICO communications for staff at this level about the stakeholder’s 
organisation and sector are seen as a solution. 


Advocacy of the ICO 


It is clear that the ICO is seen as both important to the success of stakeholders’ 
organisations and also influential in the way information rights law is applied in their 
organisations. The majority of stakeholders are advocates of the ICO, with a minority being 
neutral and fewer than one in ten being critics. 


The main factors resulting in negative views are inconsistency in information, advice and 
guidance and a perception that the ICO is not taking a proactive enough role. 


Effectiveness of the ICO 


The ICO is seen as effective in helping organisations to meet their legal obligations around 
information rights and embedding good information rights practice in their culture and 
processes. 


In both the depth interviews and the telephone survey nearly all feel that the ICO is either 
more effective now than a year ago (four in ten among the telephone survey participants) or 
is as effective as a year ago (half of the telephone survey participants). What they value the 
most about the ICO and what they are most likely to mention as in need of improvement can 
be jointly summarised as the quality of support and guidance provided and the overall 
relationships which the ICO has with stakeholders. 


The ICO’s advisory role 


Generally, participants feel that the ICO is effective in its role as an advisor and in offering 
guidance on existing information rights practice. It is with regard to emerging technologies 
where the ICO is seen as less effective, with stakeholders expressing a wish for speedier 

advice to be provided in this area. 


The ICO’s enforcement role 


Overall, the ICO is seen as an effective regulator, demonstrating impartiality and 
proportionality in its decisions. However, enforcement is one area where participants in both 
elements of the research would like to see the ICO take a more active role — or at least to 
publicise their actions more. 
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Confidence in achievement of the ICO’s stated goals 


Overall there is measured confidence in the ICO’s ability to achieve its stated goals’: 
although very few stakeholders say they are not confident, the majority of stakeholders are 
fairly confident rather than very confident. 


Respondents believe that the ICO is most likely to achieve its goal to ensure “people 
understand how their personal information is used and are able to take steps to protect 
themselves from its misuse”. Respondent are less convinced that the ICO will succeed in 
the other stated goals. 


1 The stated goals are: 

= All organisations which collect and use personal information to do so responsibly, securely 
and fairly 

= All public authorities are open and transparent, providing people with access to official 
information as a matter of course 

= People are aware of their information rights and are confident in using them 

= People understand how their personal information is used and are able to take steps to protect 
themselves from its misuse 
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Interviews took place between 13 December 2011 and 19 January 2012. Contacts were 

sent an email before fieldwork began introducing the survey and explaining that lpsos MORI 
would be contacting them. Each interview lasted approximately 25 minutes and followed the 
same structured questionnaire. A copy of the questionnaire can be found in the appendices. 


Methodology — depth interviews 


Depth interviews were conducted with 13 key stakeholders, specified by the ICO. Contact 
details were provided by the ICO. Each depth interview lasted c.30 minutes and followed the 
same discussion guide, a copy of which can be found in the appendices. The depth 
interviews took place between 16" January and 7" February 2012. 


As with the telephone interviews, each contact was sent an email by the ICO introducing the 
survey and explaining that Ipsos MORI would be contacting them. 


Interpretation of the results 


This report combines the results of the two elements of the study: the quantitative telephone 
survey and the qualitative depth interviews. 


Telephone survey 
This element comprises 58 interviews conducted with key stakeholders of the ICO: 34 of the 


interviews were with stakeholder contacts provided by the implementation team; 24 with 
contacts from the complaints team. 


ICO classification 
Complaint | Implementation 
strand strand 

Base: All respondents to the telephone survey (58) (24) (34) 
S1. Stakeholder’s self-reported role: 

Policy development/implementation role only 2 17 

(19 respondents) 
Complaints role only (1) 1 0 
Dual role (38) 21 17 


Source: Ipsos MORI 


Half of the respondents classified by the ICO as belonging to the implementation strand say 
that their role is wholly associated with policy development or implementation; half say that 
they also handle complaints. Nearly all of the respondents within the complaints strand say 
that their responsibilities cover both implementation and complaint resolution (referred to as 
“dual role” stakeholders in the report). For those with dual roles, four in ten say that not much 
of their time is spent on complaint resolution. For one respondent in the complaint strand 
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their role is solely complaint resolution and two say their role is only around implementation 
of information rights law. 


There are many differences in perceptions between those who say their role is 
implementation only and those who say they have a dual role. Therefore analysis in this 
report uses respondents’ stated role as the basis of comparison between different types of 
stakeholders, rather than using the classification provided by the ICO. Hence where the 
views of implementation stakeholders are commented on this is a group of 19 respondents, 
and where dual role stakeholders are commented on this is a group of 38 respondents. 


It should be noted, that with the small sample sizes in this research, the noted differences 
are indicative rather than definitive. 


Depth interviews 


This element comprises 13 depth interviews conducted with a range of key stakeholders. 
Again these stakeholders have a range of implementation, policy development and complaint 
resolution roles. Three participants came from the ICO’s complaints strand and ten from the 
implementation strand. 


Analysis by different groups within the stakeholders 


We have not made direct comparisons between the views of public and private sector 
organisations in the report due to insufficient sample sizes. In the telephone survey there 
are six organisations classified as “business and industry”; and three depth interviews were 
conducted with private sector stakeholders. However, where there are consistent comments 
in the depth interviews across the private sector stakeholders which differ from public sector 
stakeholders these have been highlighted in the report. 


It is not possible to analyse the results of the telephone survey by whether the stakeholder is 
responsible for data protection or freedom of information issues since this was not asked 
within the interview. 


This question was also not asked during the depth interviews, but in this environment it was 
possible to probe to establish to which field the participant's comments were related. What is 
clear from our analysis is that seven depth interviews were conducted with stakeholders 
responsible only for data protection issues, one with a stakeholder responsible only for 
freedom of information issues and five with stakeholders who were responsible for both 
fields. 


Analysis and reporting 


This report draws together the findings from both elements of the survey — with the 
qualitative findings helping to illustrate the quantitative findings and the quantitative findings 
providing context for the qualitative findings. 


The quantitative data in this report is unweighted. Because of the small base size the results 
are indicative only. While percentages are included in this report they should be treated with 
caution because of the small base sizes. It is for this reason that much of the commentary 
refers to fractions rather than the actual percentages. A full breakdown of the quantitative 
results can be found in the appendices. 


All participants in this research were given the option for their responses to be attributed or 
not to their organisation. While most are happy for their comments to be attributed, some 
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participants are not. It is for this reason that some quotes are attributed only by the research 
element and stakeholder type/role rather than to a specific organisation. 
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As with all our studies, findings from this survey are subject to our Standard Terms and 
Conditions of Contract. Any press release or publication of the findings of this survey 
requires the advance approval of Ipsos MORI North. Such approval will only be refused on 
the grounds of inaccuracy or misrepresentation. 


© Ipsos MORI North/11-050465-01 
March 2012 


0161 240 2401 


Nicola Moss 
Rose Neville 
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Perceptions of the ICO 


Contact with the ICO 


Summary 


There is clearly an established and valued contact structure in place for key stakeholders — 
most have one senior member of ICO staff as their designated contact and contact at this 
level is seen to be good. 


It has certainly improved latterly because they’ve come up with this 
new approach of having a single point-of-contact ... that’s been 
welcomed because obviously sometimes navigating as to who to go 


to can be a bit of an issue. 
Depth interview, implementation strand 


Stakeholders feel able to contact the ICO as and when they need to — to seek guidance on 
specific issues (for example vexatious FOI requests) or to raise concerns. 


Making contact 


Nearly half of respondents to the telephone survey say that they are in contact with the ICO 
once or twice a month (47%); dual role stakeholders are more likely than implementation 
stakeholders to have frequent (weekly) contact (13 of the 38 dual role stakeholders 
compared to 2 of the 19 implementation role stakeholders). 


Fig 1 
Frequency of contact with the ICO 


Q1. How often, approximately, would you say you are in contact with the ICO? 


About once every 6 months 


2-3 times a week 


Every 2-3 months 


Once a week 


Once or twice a month 


Base: All respondents to the telephone survey (58) 
Source: Ipsos MORI 


13 


This work was carried out in accordance with the requirements of the international quality standard for Market Research, 
ISO 20252:2006. 


© 2012 Ipsos MORI. 


Report on Stakeholder Perceptions for the ICO 


Most of the participants in the depth interviews indicate that they have regular, formal 
meetings with a representative of the ICO — often quarterly — to discuss policy development 
and interpretation or implementation. However, most speak much more frequently to the 
ICO (especially those with complaint resolution roles) and they value the ability to seek 
advice on an ad hoc and informal basis. 


I wanted a sounding board for a particular problem that we’ve got; it 
was freedom of information but it was related to a data protection 
law and it was a gut reaction really about whether or not the ICO felt 


that there was an issue here or not. 
Depth interview, complaint strand 


Participants in the depth interviews also state that contact is more often initiated by the 
stakeholder rather than the ICO. Indeed, one of the most valued aspects of their relationship 
with the ICO is the ability to pick up the phone and seek advice from their contact when they 
need it without having to rely on more formal communication channels. 


In our compliance function ... | would often be at odds with the 

lawyers in our business over interpretation of the Act, and we could 
always go to the Information Commissioner and say “look, we’ve got 
some internal discussions going on about what is meant by this and 


we think this and they think that, what’s your view?” 
Depth interview, implementation strand 


I think [what I value most is] the ability to be able to just pick up the 


phone and talk in a fairly informal and relaxed way about issues. 
Depth interview, complaint strand 


If there was something urgent we’d just ring them up. 
Depth interview, implementation strand 


I can phone or email them and say “this matter is ahead of us, shall 
we meet and talk about it” and they’re always accommodating; 


they’re always able to make the time and do make the meetings. 
Depth interview, implementation strand 


I often [make an enquiry] on an informal basis rather than a formal ... 
as in picking up the phone and saying “what’s the ICO’s views on 
this?” rather than trying to seek a correspondence or something set 


on record. 

Depth interview, policy development strand 

All participants in the depth interviews speak highly of the speed with which such enquiries 
are answered. 
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We get a very helpful and very quick response to any particular 


queries we have. 
Depth interview, implementation strand 


So we turned to the ICO and said “it is personal data but in our view, 
under the Transparency Agenda & Accountability, then it would be 
in the best interest of the public for that personal data to be made 
[public]” ... which the ICO agreed with and immediately drafted a 
letter to us to that effect so that we could then use that as evidence 


for why we were taking the approach that we’re doing. 
Depth interview, implementation strand 


Equally, they find a single point of contact useful in directing them to the right member of ICO 
personnel. 


It has certainly improved latterly because they’ve come up with this 
new approach of having a single point-of-contact ... that’s been 
welcomed because obviously sometimes navigating as to who to go 


to can be a bit of an issue. 
Depth interview, implementation strand 
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Feeling informed 


Summary 


Two-thirds of respondents (66%) feel they are kept informed by the ICO, although a 
significant minority would like more communications. 


The ICO’s website is the main information source and a preferred source for most 
respondents, however there are issues around the usability of the search function and the 
topicality and relevancy of all the information stored on it. 


Keeping stakeholders informed 


The ICO is seen as keeping its stakeholders well informed, although how well informed they 
feel depends on the role of the stakeholder. 


When asked how well informed they think the ICO keeps them about those areas where they 
work together, the majority (66%) of telephone respondents say the ICO keeps them very or 
fairly well informed. Implementation stakeholders feel particularly well informed (47% say that 
they feel very well informed). 


Fig 2 
Keeping stakeholders informed 


Q25. How well informed do you think the ICO keeps you about the areas which you work on 
with them? 


Tells me nothing 
Does not tell me much at all 


Very well informed 


Gives me only a 
limited amount of PAA 
information 


Fairly well informed 


Base: All respondents to the telephone survey (58) 
Source: Ipsos MORI 


The stakeholder depth interviews back this up. 
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Stakeholders look for information more frequently than they receive information: six in ten 
(62%) look for information at least once a week, one in four receive information this 
frequently (26%). Again those with a dual role look for information more frequently (nearly 
three-quarters (71%) look for information weekly). 


Fig 3 
Frequency of receiving/looking for information 
Q26. How frequently do you receive communications from the ICO? 


Q27. And how frequently do you look for information produced by the ICO about information 
rights (that is related to freedom of information or data protection)? 


E Daily E 2-3 times a week E Once a week 
m Once or twice a month m Every 2-3 months m About once every 6 months 
E At least yearly © Less often than this ™ Never 


Receive information 9% 16% 


Look for information 


Base : All respondents to the telephone survey (58) 
Source: Ipsos MORI 
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Among the telephone survey respondents, four in ten (38%) say they would like the ICO to 
be communicating with them more often; the remaining respondents (62%) say the balance 
in communications is about right. 


Fig 4 
Preferred frequency of communications 
Q28. Should the ICO be communicating with you more or less or is the balance about right? 


More communication 


About right 


Base: All respondents to the telephone survey (58) 
Source: Ipsos MORI 


The main reason for wanting more communications is to create a better relationship and 
dialogue between their organisation and the ICO. 


Build up more of a relationship and help us to understand a bit more 


about what they are about. 
Telephone interview - Dual role stakeholder, complaint strand 
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Information sources 


The website, and its function as a store of downloadable information, is a key source of 
information. Nearly all respondents to the telephone survey are aware of the ICO website 
(98%), and the ability to download information from it (97%). Further, the website and 
downloading information are the main ways respondents currently get information (79% and 
64% respectively), and they are also the most preferred sources of information (59% and 
53% respectively). 


Fig 5 
Information sources 


Q30. Which, if any, of the following information sources from the ICO are you aware of? 
Q31. In which ways do you currently get most of the information you need from the ICO? 


Q32. And how would you prefer to get most of the information you need from the ICO? 


_ % mentioning 


Looking at the ICO website 5) 79% ane 
o 


Downloading information from the = 97% 
ICO website 53% ‘ 
74% 
Receiving publications 
&P = z 
E-newsletter 4 4, 60% 
o 


Receiving e-mails Loi R BE% 
o 
“3 71% 
Receiving news releases = g 
(3) 
Meetings = Ia, 76% 
(+) 
Telephone contact —= Ey TA 
(+) 
Social media a W seta 
o 
40% 
Blog 0%? m Aware of source 


Other nO m Current source 
(3) 
| m Preferred source 


Don’t know Ns 
n 


Base : All respondents to the telephone survey (58) 


Source: Ipsos MORI 


Receiving emails (88%), telephone contact (93%) and face-to-face meetings (76%) are also 
well recognised sources of information. Though fewer stakeholders use these sources there 
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does not appear to be any unmet demand for these options. Indeed the preferred sources of 
information closely match the currently used sources of information. 


Two-thirds of those who use the ICO website (66%) say that it is a good source of 
information. The value placed on the website by stakeholders is illustrated in their wish to 
see it improved, specifically maintaining and keeping the online library up to date. 


Need to be updating their communications generally. Pd like to be 
able to find far more information about the issues I deal with ... | 
don’t see their guidance being updated as much as it should be, for 


example Workplace Survival Guide. 
Telephone interview - Policy/implementation role, implementation strand 


The only negative comments about the website refer to the ease of navigation, and 
specifically the ability to search for information — with respondents to the telephone survey 
and the depth interviews mentioning the problems of finding the specific information they 
require. 


Unless you actively look for stuff, you have to know it’s there. 
Telephone interview - Dual role stakeholder, implementation strand 


The knowledge is really hard to find and I had to get an email sent 


with a link to it to be able to find it. 
Telephone interview — Dual role stakeholder, Implementation strand 


One depth interview participant also suggested removing superseded advice/ guidance as an 
action the ICO should take. Further, several depth interview participants mention that they 
track the decisions coming out of the ICO, tribunals and other adjudicating bodies — for them 
having an up-to-date source of information is seen as an improvement over the current 
website. 


Among the seven respondents who are aware of the website but do not use it, five say this is 
because their work is too specialised — nearly all of these respondents are involved with 
policy development rather than implementation. 
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Working relationship with the ICO 


Summary 


The ICO clearly has very good relationships with its key stakeholders, being seen to work in 
a collaborative manner and acknowledging the expertise of their stakeholders. 


We’ve been able to work together to bring around the required 
improvements which they wanted and obviously it’s helped the 


Metropolitan Police, so that’s been really, really constructive. 
Depth interview, implementation strand 


Stakeholders generally have very positive perceptions of the ICO staff they contact and 
relationships are generally seen to have either improved or stayed the same. 


Experiences of more junior staff, essentially the complaint case worker level, are less good. 
The issues for stakeholders are twofold: 


= new case workers are perceived to lack knowledge of the client and established 
working practices; and 


" inconsistencies in the advice given by different individuals on the same point of 
compliance. 


I think it’s fair to say we have had issues with the case workers from 
those [regional] offices, either having a different interpretation of 
the Act or dealing with things in a way which we’d already agreed 


with Wilmslow wouldn’t happen in the future. 
Depth interview, implementation strand 


However, for most stakeholders this is not seen as being a major problem, more a niggle or 
an irritation rather than an issue. For those depth interview participants who mention this as 
an issue better internal ICO communications for staff at this level about the stakeholder’s 
organisation and sector are seen as a solution. 


One comment from the depth interviews sums up stakeholders’ perceptions of ICO staff: 


The staff at the ICO are reliable and sensible which is sort of a key 


defining factor of a service really 
Depth interview, complaint strand 


Defining stakeholders’ relationships with the ICO 


All of the participants in the depth interviews have a designated contact at the ICO, all use 
this person as their first port of call when making an enquiry. It is the seniority of their 
contact at the ICO which is valued by participants in the depth interviews — their contact’s 
ability to speak with authority and experience and offer the guidance which they seek. 
Another key aspect of the personal relationship is the ability of their contact to actas a 
gatekeeper, signposting queries to the most appropriate personnel at the ICO. 
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We have a very progressive relationship, a very open relationship, 
we have the ability to speak to key individuals on the phone and get 
guidance fairly quickly, we get a very good response from them and I 


think that’s testament to the way the relationship is established. 
Depth interview, implementation strand 


Nearly all respondents are satisfied with the relationship they have with the ICO (90%), 
indeed half are very satisfied (52%). Implementation role stakeholders are more likely to say 
they are very satisfied (74%). One respondent is dissatisfied with the relationship; with five 
saying they are neither satisfied nor dissatisfied. 


Fig 6 
Satisfaction with relationship with the ICO 


Q13. Overall how satisfied or dissatisfied are you with the relationship you have with the 
ICO? 


m Very satisfied m Fairly satisfied m Neither/nor 
E Fairly dissatisfied E Very dissatisfied E Don't know 


Satisfaction with relationship with 
the ICO 


Base : All respondents to the telephone survey (58) 
Source: Ipsos MORI 


These views are highlighted in comments made by participants in the depth interviews which 
reflect their positive feelings about the working relationship whilst being mindful of the ICO’s 
regulatory role. 


= They describe a relationship of two equal partners, each with acknowledged areas of 
expertise. Several mention that they work closely with the ICO on committees and other 
bodies responsible for ensuring continuing information rights compliance in their sector. 


We help them with investigations that they’re making, so we will 
actually volunteer information to them to help them with any 
investigations that they’re doing. For example, I think there’s an 
investigation on-going at the moment in relation to spam 


marketing. 
Depth interview, complaint strand 


I think we have our own expertise and we both bring something 


to the table. 
Depth interview, implementation strand 
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In certain areas [the relationship is] critical; there are things that 
we need to be able to do with personal data to advance our 
business but without the help and support of the ICO it wouldn’t 


be possible for us to achieve. 
Depth interview, implementation strand 


While all state that the ICO listens to but does not always agree with their opinions, this 
is felt to be a natural consequence of the ICO’s dual role as advisor and regulator and 
hence is not seen as an issue in the relationship. 


Where we may not necessarily agree with an interpretation, 
ultimately we may go to an Information Tribunal ... in order to get 
some meaningful case law on the interpretation of a particular 
legal argument. But we'll do that in a not falling out way 


wherever possible because we value the relationship. 
Depth interview, implementation strand 


We had a really pragmatic way of accepting that we weren’t 
going to win this argument, and looking at how we could manage 
it. 

Depth interview, implementation strand 


It’s very professional but not a cosy relationship, and I think 
that’s the way it should be because clearly the thing to 


remember is that the Commissioner is a regulator first. 
Depth interview, implementation strand 


In general the relationship with the ICO is seen as different to that with other European 
regulators who take a more “hard nosed” attitude to data protection legislation 
enforcement. Participants value their more informal relationship with the ICO, 
specifically the ability to ask for advice and clarification rather than having to make 
formal submissions. 


[The relationship with the ICO is] very different from the way that 


many European countries operate, where it’s a lot more 


confrontational. 
Depth interview, implementation strand 
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I think that the Commissioner in this country is outstanding in 
relation to the method that they employ in furtherance of their 
office. The willingness to provide guidance and to be receptive 
to questions that we may raise is actually rather unique. My 
view is that certainly across the rest of Europe, there is a much 
more hardnosed line now being taken with regard to the role and 


function of Information Commissioners. 
Depth interview, implementation strand 


These views are also apparent among respondents to the telephone survey where three- 
quarters see ICO staff as seeking to work collaboratively (78%), to listen to and take account 
of their organisation’s views (76%), hence to understand the context in which the 
stakeholder’s organisation works (78%) and to help them achieve more than they could 
working alone (69%). In all these aspects although both types of stakeholders are equally 
likely to agree they apply, implementation/policy role stakeholders are more positive — being 
more likely to say they strongly agree than are dual role stakeholders. 


Fig 7 
Opinions of ICO staff 


Q16. Thinking about how the ICO staff engage with you and your organisation, to what 
extent do you agree or disagree that they...? 


E Strongly agree E Tend to agree ™ Neither agree nor disagree E Tend to disagree E Strongly disagree 


Understand the 

context in which 

my organisation 
operates 


10% 12% 29 


Seekto work 
collaboratively 
with my 
organisation 


16% 5% 


Listen to and 
take account of 
the views of my 

organisation 


Help me and my 
organisation 
achieve more 

than we could... 


7% 3% 


Base: All respondents to the telephone survey (58) 
Source: Ipsos MORI 
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Changes to the relationship 


All but one respondent to the telephone survey say their relationship with the ICO has either 
stayed the same or improved (98%). These views are shared by participants in the depth 
interviews. 


Fig 8 
Perceived change in relationship 


Q17. Would you say that over the past year your working relationship with the ICO has got 
better, worse or stayed the same? 


Better 


Stayed the same 


Base: All respondents to the telephone survey (58) 
Source: Ipsos MORI 


Dual role stakeholders are more likely to say the relationship has stayed the same over the 
last year (63%); implementation role stakeholders are more likely to say that it has got better 
(58%). 


Reflecting earlier comments, it is increased communication which has had a positive impact 
on relationships, together with a willingness on the part of the ICO to focus on specific issues 
of interest to individual stakeholders. Typical comments from the telephone survey which 
illustrate this point include: 


Because we seem to have more interaction and they seem to have a 
designated case worker for each business they are dealing with at 
the time ... You are dealing with someone that's specifically dealing 


with the business. 
Telephone interview - Dual role stakeholder, complaints strand 


We have more contact and are working on a range of issues. 
Telephone interview - Implementation stakeholder, implementation strand 
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They understand us a lot better and we understand them a lot 
better. They've taken the time to look at the complexities with our 


world rather than a one size fits all [view]. 
Telephone interview - Dual role stakeholder, implementation strand 


The importance of this willingness on behalf of the ICO to spend time learning about 
stakeholders is reinforced in the depth interviews: 


We do data, so data protection is core to everything we do. So we’re 
very keen to get it right and to understand what the objectives are 
and the Information Commissioner has been very supportive in 
working with us to make sure that we are working in step with them 


and we’re keen to do that. 
Depth interview, implementation strand 


The one telephone respondent who is dissatisfied with their relationship with the ICO also 
feels their relationship has deteriorated in the last year. Whilst the relationship is not 
satisfactory, the respondent is positive about the professionalism and attitude of staff. Their 
dissatisfaction with the relationship is based on disagreements around policy development 
and implementation and the role they feel the ICO should play. 
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Perceptions of staff 


In general in the telephone survey, implementation/policy development role stakeholders are 
more positive about their relationships with staff at the ICO than are dual role stakeholders — 
they are more likely to agree that it is easy to identify the right contact (three-quarters (79%) 
of implementation stakeholders compared to six in ten (58%) of dual role stakeholders) and 
that they have a consistent standard of relationship with the people they deal with (89% 
compared to 74% respectively). Respondents in the telephone survey feel less able to say 
whether the ICO has sufficient staff, with one in five (21%) saying they don’t know and 
opinion fairly evenly split between agreement (28%) and disagreement (38%) that there is 
sufficient staff for those who answered. 


Fig 9 
Perceptions of ICO staff 


Q14. And how much do you agree or disagree with the following statements? 


E Strongly agree E Tend to agree m Neither agree nor disagree 
m Tend to disagree m Strongly disagree = Don’t know/no opinion 
It is easy to 
identify the right 
people to speak 17% 


tointhe ICO ona 
particular issue 


The ICO has 
sufficient number 
of staff 


Ihave a 
consistent 
standard of 

relationship with 
allthe people | 
deal with at the... 


7% 71% T% 


Base: All respondents to the telephone survey (58) 
Source: Ipsos MORI 
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Generally ICO members of staff are viewed positively by stakeholders in the telephone 
survey, being seen as professional, helpful, knowledgeable and building relationships based 
on trust. Where there is less agreement is with regard to consistency of information and 
being focused on outcomes. 


Fig 10 
Staff Attributes 


Q15. | am going to read out a number of attributes which describe how people work. Thinking 
about the people you typically deal with at the ICO, can you rate them against each of these 
attributes according to whether you think the people are generally very good, fairly good, 
poor or very poor in this area. 


_ % saying very/fairly good 
| 


Being professional TE 93% 


Being friendly and helpful Sy 93% 
Being focused on outcomes e 81% 
Being knowledgeable e 91% 
Being consistent in the information they provide E 71% 


j 


Building relationships based on trut ME 36% 


Base : All respondents to the telephone survey (58) 
Source: Ipsos MORI 


Again, implementation/policy development role stakeholders in the telephone survey are 
more positive than are dual role stakeholders, perhaps reflecting the more one-to-one 
relationships among the implementation stakeholders compared to the casework based 
handling of complaints which means dual role stakeholders are speaking to a wider pool of 
(more junior) ICO staff. 


Consistency of information and advice 


The issue raised most in the telephone survey and depth interviews is consistency of 
information and advice, and is centred on case worker level contact. Several participants in 
the depth interviews suggest the problem may arise from lack of experience at this level, or 
lack of understanding of the business context of the stakeholder’s organisation — with the 
consequent frustration at having to repeat this process with each new case worker when 
complaints are being processed. 


Sometimes there are slightly different interpretations and I can’t 
speak specifics there, but | know team members have raised 
concerns that perhaps different individuals within some of the teams 


take a slightly different line than that of previous people. 
Depth interview, implementation strand 
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If somebody new is dealing with something, they don’t necessarily 


understand the process that we have in place. 
Depth interview, complaint strand 


I think perhaps that understanding of what we’re trying to achieve 
isn’t always present at a lower level within the team, so through 
dialogue we’re trying to improve that again with the enforcement 
teams within the ICO’s areas, because I think some of the staff 
perhaps at a lower level operate perhaps at a more process level 
and don’t always have the understanding of what we’re struggling 


with. 
Depth interview, implementation strand 


Several stakeholders find the inconsistencies in knowledge to have negative implications for 
their organisations, and cause more work as they need to reiterate established working 
practices with each new ICO member of staff. For other stakeholders the inconsistencies in 
advice are less of an issue and more a reflection of the complexity of information rights 
legislation itself and the lack of precedent-based interpretation. 


I think they may find it difficult to definitively say “this is what you 
can do or can’t do”. There’s always this onus back to say “this is 
our advice but ultimately it’s your decision” and I think that’s 


probably down to the high level Act really. 
Depth interview, implementation strand 
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Advocacy of the ICO 


Summary 


It is clear that the ICO is seen as both important to the success of stakeholders’ 
organisations and also influential in the way information rights law is applied. The majority of 
stakeholders are advocates of the ICO, with a minority being neutral and fewer than one in 
ten being critics. The main factors resulting in negative views are inconsistency in 
information, advice and guidance and a perception that the ICO is not taking a proactive 
enough role. 


These positive findings are reflected in the ICO’s performance against the Ipsos MORI public 
sector norms — with the ICO achieving more positive scores for each measure. 


The ICO’s influence 


It is clear that the ICO is seen as both important to the success of stakeholders’ 
organisations and also influential in the way information rights law is applied within their 
organisation. 


The importance of this influence is reflected in comments from the depth interviews where 
several participants report actively looking for decision notices and monitoring how 
information rights are developing in order to ensure that they are kept up-to-date with issues. 
Their definitive source of information for this is the ICO website and the ICO is their arbiter of 
whether the implementation has been successful. 


We have to keep those close links with the regulators simply 
because the volume of data that we handle, the level of business 
that we’re managing, we are a significant data controller and we 
want to make sure that we’re not spending billions of pounds doing 
something that actually the Information Commissioner wouldn’t be 


happy with. 
Depth interview, complaint strand 
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More than eight in ten (83%) say the ICO has influence in their organisation, with half (50%) 
saying it has a lot of influence. 


Fig 11 
ICO’s influence over application of information rights law 


Q10. How much influence, if any, does the ICO have over how your organisation applies 
information rights law? 


Not much 
influence, 10% 


No influence at 


A little all, 2% 
influence, 33% 
Don’t know/No 
opinion, 5% 
A lot of 


influence, 50% 


Base : All respondents to the telephone survey (58) 
Source: Ipsos MORI 


Participants in the depth interviews concur with these sentiments. 


It has a huge influence, it’s a principle regulator and with our 
principle asset being data, what they say goes and doesn’t go is 


paramount to what we do. 
Depth interview, implementation strand 


Where they say the ICO has less influence it is generally because their organisation commits 
a large amount of resource to the issues around information rights and has built up 
considerable internal expertise, therefore the ICO’s advice and guidance is welcome but not 
crucial to their success. 


We use them as a bit of an advertising background for its 
enforcement role but nothing much more than that. Our main focus 
is to convince people to do things properly and efficiently because 


that’s really what it’s all about. 
Depth interview, complaint strand 
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Compared to other regulators [the ICO’s influence is] pretty low; we 
as a business obviously data privacy is one of our key activities. We 
have our policy and our framework in place and we have a reporting 
line that goes up through the various governance committees to 
highlight any issues and get activities undertaken if we need to, to 


be compliant. 
Depth interview, complaint strand 


I would say that a police service, not just Met Police, but the police 
service has always taken both sets of legislation seriously and | 
don’t think there’s any undue influence that regulatory bodies have. 


I think we’ve always wanted to comply anyway. 
Depth interview, implementation strand 


We make decisions not because we think that the ICO is sitting on 
our shoulder watching every move, but I think what they’ve done is 
that they’ve given us and organisations like ours a pretty good basic 


understanding of what they expect. 
Depth interview, implementation strand 


Four in ten respondents to the telephone survey (41%) consider the contact they have with 
the ICO to be critical to the success of their work, a further four in ten feel it is very important 
(38%). These views are also apparent among participants in the depth interviews. 


Fig 12 
Importance of the ICO to stakeholders’ organisations 


Q2. And how important is the contact you have with the ICO to the success of your work (i.e. 
to help you and your organisation deliver your goals)? Would you say... 
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Very important 


1 1 


important  ..:. 


Base: All respondents to the telephone survey (58) 


38% 


Source: Ipsos MORI 


In the telephone survey eight in ten (81%) say they view the ICO favourably with 
(28%) saying they have a very favourable view — this is more positive than the Ip 


a quarter 
sos MORI 


public sector organisation benchmark where two-thirds (66%) hold favourable views of the 


organisation. 


Fig 13 
Overall opinion of the ICO 


Q3. How favourably or unfavourably do you regard the ICO, bearing in mind we are 


interested in your overall impressions? 


Very unfavourable 


Neither favourable nor 
unfavourable 


Very favourable 


Mainly favourable 


Base: All respondents to the telephone survey (58) 


Source: Ipsos MORI 
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Advocates 


All of the participants in the depth interviews and over half of respondents to the telephone 
survey are advocates of the ICO (55%), a third (36%) would be neutral; fewer than one in ten 
(9%) would be critical of the ICO. These findings are in line with the Ipsos MORI public 
sector organisation benchmarks (46% would be advocates, 40% neutral and 12% critics). 


Fig 14 
Advocacy of the ICO 


Q4. Which of these phrases best describes the way you would speak of the ICO to other 
people? 
i would be critical of the 
ICO without being asked 
| would be critical of the ICO 
if | were asked 


| would speak highly of the 
ICO without being asked 


| would be neutral 
towards the ICO 


| would speak highly of 
the ICO if | were asked 


Base: All respondents to the telephone survey (58) 
Source: Ipsos MORI 


It is the quality of advice, and the pragmatism displayed in their advice, as well the 
professionalism of staff which underlies the opinions given by advocates. Typical comments 
from respondents who would speak highly of the ICO include: 


They have always given us good advice on freedom of information 


and data protection. l respect their professionalism. 
Telephone interview - Dual role stakeholder, implementation strand 


As an organisation I find them open, accessible and responsive. 
They take time to understand their stakeholders’ issues and 


approach. 
Telephone interview - Policy/implementation role stakeholder, implementation strand 
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I find them very approachable. Their advice and guidance is very 


pragmatic. They are aware of commercial issues. 
Telephone interview - Dual role stakeholder, complaint strand 


Compared to the regulators in the EU they have a very sensible 


approach. 
Telephone interview - Dual role stakeholder, complaint strand 


Critics 


For the five respondents who would be critical of the ICO it is issues around inconsistency of 
the advice given by ICO staff, and to a lesser extent a feeling that the ICO has not taken up 
the leadership role expected of them, which underlies their critical views. 


I think it's very often inconsistent. My clients ring the ICO for advice 
and get advice off one person and then totally different advice off 


another. 
Telephone interview - Policy/implementation role stakeholder, implementation strand 


[It] can sometimes be a bit difficult to get a clear answer so on the 
project I'm working on I've heard a lot of comments from other 
people about this ... We're not always sure what they're saying to me 
is the general consensus with what they're saying to someone else. 
If you speak to someone else in the industry they have been given a 


slightly different view. 
Telephone interview - Policy/implementation role stakeholder, implementation strand 


I don't believe that they play the leadership role they should be 
playing. They seem to arbiter a very limited interpretation of the 
Data Protection Act where as their counterparts in almost all 


jurisdictions play a more proactive role. 

Telephone interview - Policy/implementation role stakeholder, implementation strand 
While none of the depth interview participants would speak critically of the ICO, they also 
mention these issues. 
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Effectiveness of the ICO 


Summary 


In both the depth interviews and the telephone survey nearly all feel that the ICO is either 
more effective now than a year ago or is as effective as a year ago. What they value the 

most about the ICO and what they feel needs improving can be jointly summarised as the 
quality of support and guidance provided and the overall relationships which the ICO has 

with stakeholders. 


Compared to a year ago 


Nearly all respondents to the telephone survey feel that the ICO is more effective now than a 
year ago (41%) or is as effective as a year ago (47% of respondents). This is similar to the 
views expressed in the depth interviews. 


Fig 15 
Effectiveness of the ICO compared to a year ago 


Q7. Compared to one year ago, do you think the ICO is more effective or less effective in its 
role now or has it stayed the same? 


Don’t know/No opinion 


More effective 


Stayed the same Uri 


Less effective 


Base: All respondents to the telephone survey (58) 
Source: Ipsos MORI 


Among telephone survey participants, four respondents feel that the ICO is less effective 
now than a year ago, three of these respondents have policy development/ implementation 
roles. 

The programme I’m working on, there is a lot of policy debate going 
on about privacy and data protection. The ICO haven't necessarily 
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taken as much of a leading role in that as perhaps they should have 
done in my view. They have not given as clear advice to some 


people in the programme as they could have. 
Telephone interview - Policy/implementation role stakeholder, complaint strand 


I believe since the change in leadership there has been a slight loss 
in the consistency being dispatched from the top and the individuals 


we deal with. 
Telephone interview - Policy/implementation role stakeholder, implementation strand 


They are better at managing data protection breaches but in relation 


to ISO regulation they are not as thorough. 
Telephone interview - Dual role stakeholder/complaint strand 


Improved effectiveness is the result of improved communications and more efficient working 
(especially with regard to the backlog of complaints). 


It comes down to communication, leadership and a more public 


facing role. 
Telephone interview - Dual role stakeholder, complaints strand 


[It’s more effective] because its complaints handling is significantly 


more efficient. 
Telephone interview - Policy/implementation role stakeholder, implementation strand 


Better case handling procedures. Their bureaucracy has been cut 


down and quicker decisions. 
Telephone interview - Dual role stakeholder, implementation strand 


To a lesser extent improvements in enforcement action is also seen to make the ICO more 
effective now compared to a year ago. 


They are now showing their teeth with fines. Now taken more 


seriously, they are to be feared as before they were toothless. 
Telephone interview - Dual role stakeholder, complaints strand 


Improving effectiveness 


For participants in both the telephone survey and the depth interviews, what they value the 
most and what they feel needs improving can be jointly summarised as the quality of support 
and guidance provided and the overall relationships which the ICO has with stakeholders’. 
So while it is advice and support which is most valued, this is also an area where 


2? A copy of all the comments made to these questions in the telephone survey can be found in the 
appendices. 
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improvements could be made — specifically around the frequency of communications and 
providing a user-friendly website with easier to understand guidance. 


I think [the ICO should] continue with the regular and proactive 
dialogue with us which we find supports us in our objective to 


comply with the legislation. 
Depth interview, implementation strand 


Equally while many stakeholders value how accessible and approachable ICO staff are, 
many also want a better relationship with greater understanding of their organisation (this 
view is strongest among respondents to the telephone survey). As put simply by several 
depth interviewees — the simple fact that the ICO is there is what they value most, the ICO’s 
presence as an external regulator is useful when talking to (sometimes reluctant) internal 
colleagues about the importance of compliance with the various pieces of legislation. 


Knowing particularly under DPA that they have enhanced powers 
does concentrate the mind of my employees and the staff in this 
organisation just a little bit more and reinforces the organisation’s 


view on how important it is to get these things right. 
Depth interview, implementation strand 


In addition to these views, depth interview participants also mention the role of the ICO in 
championing the excellence of data protection compliance in the UK; the ICO taking a more 
proactive policy development role and increasing focus on their enforcement role. 


What I want them to do is to bang the drum a bit more about how 


good data protection is in the UK. 
Depth interview, implementation strand 


The telephone survey also offered respondents the opportunity to say what they think are 
missing priorities; here nearly half of respondents said nothing. Among those who gave a 
response there is a wide range of issues with several emerging themes”: 

= Playing a more proactive role in policy development/harmonisation; 

= Increasing the enforcement role/activity; 


= Reducing the burden of compliance on organisations; and 


= Educating the public in their individual responsibilities as well as their information rights. 


° A copy of all the comments made to this question in the telephone survey can be found in the 
appendices. 
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The ICQ’s advisory role 


Summary 


Generally participants feel that the ICO is effective in its role as an advisor and in offering 
guidance on existing information rights practice. Perceptions on the effectiveness of specific 
aspects of the ICO’s role are largely determined by whether the respondent has an 
implementation/policy development role or a dual role. 


It is with regard to emerging issues and technologies, such as cloud computing, data 
anonymisation and contactless payment technology where the ICO is seen as less effective, 
with stakeholders expressing a wish for speedier advice to be provided in this area. 


Perception of the advisory role 


Nine out of ten respondents to the telephone survey (88%) feel that the ICO is effective in its 
role as an advisor. Five of the six respondents who feel the ICO is not effective are dual role 
stakeholders. 


Fig 16 
Effectiveness of the ICO as an advisor 


Q6. The ICO has a number of roles, how effective, if at all, is the ICO in ...? 


E Very effective E Fairly effective E Not very effective 
m Notat all effective = Don't know 
Effectiveness as an advisor 41% AT%, 0%, 


Base : All respondents to the telephone survey (58) 
Source: Ipsos MORI 
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The ICO is seen as effective in helping stakeholders’ organisations to meet their legal 
obligations around information rights by eight in ten telephone survey respondents (79%). 
Dual role stakeholders are more likely to say the ICO is effective at this than are 
policy/implementation role stakeholders (92% and 53% respectively). 


Fig 17 
Effectiveness of ICO in helping stakeholders’ organisations 


Q9. How effective, if at all, is the ICO at helping your organisation to achieve the following 
outcomes? 


E Very effective E Fairly effective E Not very effective E Not at all effective E Don't know 


Meeting your 
legal obligations 
inthe way you 
respond to 
people exercising 
their... 


Raising 
awareness in the 
organisation of 
all your wider 
obligations under 
information... 


Base: All respondents to the telephone survey (58) 
Source: Ipsos MORI 


Six in ten telephone survey respondents (60%) feel the ICO is effective in helping to raise 
awareness of the wider information rights law obligations in their organisations. For this 
statement policy and implementation stakeholders are more likely to agree than are dual role 
stakeholders (63% and 58% respectively). 


There was some European legislative proposals which came out last 
week and they just shared that information with us without us 
prompting; the ICO did an initial statement from that which again 


was really helpful. 
Depth interview, implementation strand 
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Eight in ten respondents to the telephone survey who handle complaint resolution feel the 
ICO is effective at providing information on how to improve procedures (80%), a similar 
proportion (77%) are satisfied with the explanations given of what needs to be done to 
resolve complaints. Fewer, around half (49%) are satisfied that the ICO supports their 
organisation in improving information rights processes. 


Fig 18 
The ICO’s supporting information 


Q24a. How effective is the ICO in...? 


mVery effective m Fairly effective mFairlyineffective m Very ineffective = Don'tknow/no opinion 
... providing 
informationon 
how to improve 
procedures 


Q23b/c. How satisfied or dissatisfied are you with the following? 


E Very satisfied m Fairly satisfied m Neither satisfied nor dissatisfied 


E Fairly dissatisfied m Very dissatisfied E Don’tknow/no opinion 


Supporting your 
organisation in 
improving 
Information 8% 3% 10% 
Rights processes 
following 
complaints 


The explanations 
given of what 
your organisation 
needs to do to 
resolve the 
complaint 


Base: All respondents to the telephone survey with complaints resolution role (39) 
Source: Ipsos MORI 
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In the telephone survey, stakeholders with an implementation or policy development role are 
positive about the ICO’s advisory role with nearly nine in ten saying the ICO is effective in 
basing advice (86%) and decisions (88%) on evidence and good practice. A similar 
proportion (86%) agrees that the ICO is open and transparent about their views on particular 
issues; and that they are as clear as possible in explaining the ICO’s views (88%). 


Fig 19 
Effectiveness of the ICO’s advisory role 


Q20. In working with your organisation, how effective or ineffective do you think ICO staff are 
at the following? 


m Very effective W Fairly effective m Fairly ineffective mVery ineffective E Don't know/no opinion 


Beingas clear as possiblein 


40% 47% 12% 


explainingthe ICO’s views 


14% 2989 


18% 2% 9% 


Basing advice on evidence 


and good practice 23% 63% 11% 49 


Basing decisions on evidence 


21% 67% 9% AY 


and good practice 


Q19. Thinking about how the ICO engages with you and your organisation, to what extent do 
you agree or disagree that...? 

E Strongly agree E Tend to agree E Neither agree nor disagree 

E Tend to disagree E Strongly disagree E Don't know/no opinion 


. they are willing to consider 
challenges to their policies or 16% 45% 25% 11% 49 
thinking 


1 


. they are open and 
transparent about their views 35% 51% 14% 
on particular issues 


4 


. they are able to respond 
quickly to new priorities 
which affect your 
organisation 
. they are good atinvolving 
their stakeholders in the 
development of policies and 
strategies 


4% 5% 


9% 54% 19% 9% 2%7% 


Base: All respondents to the telephone survey with implementation role (57) 
Source: Ipsos MORI 
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Among respondents to the telephone survey, there are positive views about how well the 
ICO shares information, solutions, intentions and good practice: eight in ten (81%) agree 
they share as much as possible and seven in ten (72%) that they do so as early as possible. 
Fewer, six in ten (61%) agree that the ICO is willing to consider challenges to their policies 
and thinking. As mentioned earlier, the ICO’s willingness to listen to their organisation’s 
views, even if they do not agree, is a valued aspect of the relationship for those who took 
part in the depth interviews. Depth interview participants also value the ability to call their 
contact direct when they wish to understand the ICO’s view on specific points’. 


If it was something that we urgently needed their advice on we 


would give them a call, and I have done that. 
Depth interview, implementation strand 


Six in ten (63%) telephone interview stakeholders with implementation or policy development 
roles agree that the ICO involves stakeholders in the development of policies and strategies. 
Fewer still, four in ten (44%) of those with implementation or policy development roles agree 
that the ICO responds quickly to new priorities. Timeliness of decisions is an issue for one 
depth interviewee, but the majority are happy that the ICO responds as quickly as they 
expect/require®. 


I don’t actually agree that things have improved ... they’ve traded off 
quality for quantity ... On the first three or four years of the 
legislation, they made the decision, and whether we agreed with it 
or not is not the point, I can actually map back to when they made 
the decision and you could see why they made that decision. But I 
think now, because they’re maybe rushing or trying to clear 
backlogs, [or] they’re not as good at articulating why they made that 
decision, sometimes the decision seems slightly rushed. So I think 
they have improved in timeliness but I think that’s been at the 


expense of the quality. 
Depth interview, implementation strand 


4 Results shown on Figure 19, page 41 
° Results shown on Figure 19, page 41 
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Half of the telephone survey respondents (53%) state the ICO is effective in embedding good 
practice into emerging technologies; though a significant proportion of implementation/policy 
development stakeholders say they don’t know (26%). For participants in the depth 
interviews, it was often the timeliness of guidance which is the issue, several expressed the 
view that they would rather have some “first thoughts” quickly with more considered and 
complete guidance to follow at a later date than to wait for the formal guidance to be given. 


Fig 20 
Effectiveness in embedding information rights 


Q9c. How effective, if at all, is the ICO at helping your organisation to achieve the following 
outcomes? 


E Very effective E Fairly effective E Not very effective E Not at all effective E Don't know 


Embedding good 
information 
rights practice 
into emerging 
technologies and 
systems 


Base: All respondents to the telephone survey (58) 
Source: Ipsos MORI 


It would be quite useful to see more guidance from them even like 
positioning papers, their opinion on a particular issue rather than it 
being a specific guidance. 

Depth interview, complaint strand 


The ICO came out at a very early stage and said “we expect laptops 
to be encrypted, that is the absolute minimum that we expect as a 
control” without necessarily specifying the encryption standard 
saying they expect them to be encrypted. That sort of direction, 
that opinion is quite useful because it gives us a clear indication of 


what they see as being appropriate. 
Depth interview, complaint strand 


The ICO sometimes thinks too long about the advice they give 
officially and it’s like shutting a door after the horse has bolted ... I 
don’t think they always get the balance between getting the 


guidance 100% right and getting it out in time. 
Depth interview, implementation strand 
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The ICO’s enforcement role 


Summary 


Overall, the ICO is seen as an effective regulator, demonstrating impartiality and 
proportionality in its decisions. Participants in both the depth interviews and the telephone 
survey spontaneously mention the ICO’s chosen stance on enforcement as being preferable 
to that of other, European, enforcement bodies. This does not mean they view the ICO asa 
less effective enforcer, but rather that they value the ICO’s willingness to work with their 
organisations and to take a pragmatic approach to enforcement. 


However, enforcement is one area where participants in both the depth interviews and 
telephone survey would like to see the ICO take a more active role — or at least to publicise 
their actions more. 


There’s only so much hand-holding the regulators can do before they 


start having to do their more enforcement type role. 
Depth interview, complaint strand 


Participants in the depth interviews also highlight the potential conflict in the ICO’s dual role 
as both an advisor and enforcer and the resultant impression that the ICO is forced to “sit on 
the fence” on many issues where participants would like some clear cut guidance. 


There is a difficulty they face in being a regulator in giving direct 
advice on a matter which they may have to stand in judgement on in 


the future. 
Depth interview, implementation strand 


Overall effectiveness 


Eight in ten respondents to the telephone survey (83%) say that the ICO is effective as a 
regulator, and seven in ten (69%) that it is effective in resolving complaints. 


Fig 21 
Effectiveness of the ICO in its enforcement role 


Q6. The ICO has a number of roles, how effective, if at all, is the ICO in ...? 


m Very effective @ Fairly effective E Not very effective 
E Notat all effective E Don't know 


Effectiveness asa 
regulator on information 17% 66% 12% 5% 
rights law 


Effectiveness in resolving 
complaints on information 14% 17% 
rights law 


Base : All respondents to the telephone survey (58) 
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Source: Ipsos MORI 


Elements of effectiveness 


Nine in ten respondents to the telephone survey (88%) say that the ICO is effective in 
demonstrating impartiality in its decisions and three-quarters (76%) that it is effective in the 
proportionality of its decisions. 


Fig 22 
Effectiveness of the ICO’s decisions 


Q6. The ICO has a number of roles, how effective, if at all, is the ICO in...? 


E Very effective E Fairly effective E Not very effective E Not at all effective E Don't know 


... the 
proportionality of 
its decisions 


... the way it 
demonstrates 
impartiality in its 
decisions 


Base: All respondents to the telephone survey (58) 
Source: Ipsos MORI 


These results are higher among those stakeholders with a dual role; there is a small but 
significant proportion of implementation/policy development stakeholders who say they do 
not know about the ICO’s effectiveness in these areas (11% and 16% respectively). Lack of 
awareness among implementation/policy development role stakeholders is especially high 
with regard to effectiveness in resolving complaints where four in ten (42%) of this group 
chose the “don’t know” option. 
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A smaller proportion (67%) feel that the ICO is effective in embedding good information rights 
practice into their organisation’s day to day processes. 


Fig 23 
Effectiveness in embedding information rights 


Q9c. How effective, if at all, is the ICO at helping your organisation to achieve the following 
outcomes? 


E Very effective E Fairly effective E Not very effective E Not at all effective E Don't know 


Embedding good 
information 
rights practice 
into the culture 22% 3% 7% 
and day to day 
processes of your 
organisation 


Base: All respondents to the telephone survey (58) 
Source: Ipsos MORI 


Again there is a significant proportion of implementation/policy development stakeholders 
who say they don’t know. This may be explained by comments in the depth interviews where 
several participants who are otherwise advocates of the ICO and very positive about its 
effectiveness and role also express the view that the ICO has little influence in how good 
practice is implemented in their organisations. In these cases they go on to state that their 
organisation would take compliance very seriously with or without the presence of the ICO — 
for some stakeholders (such as Equifax or Experian) their whole business model depends on 
being seen as trustworthy data handlers. In these circumstances it is not surprising that the 
ICO’s influence is lower given the high priority already present in these organisations. 


Telephone interview stakeholders with a complaint resolution role were asked about a 
number of aspects of the ICO’s enforcement role, opinions are generally positive: 


= Eight in ten (82%) believe the ICO is effective in explaining the rationale behind 
decisions; 


7 Three-quarters (77%) are satisfied with their contact with the ICO about resolving 
complaints; 


= Seven in ten (67%) are satisfied with the ICO’s process for handling complaints; 


= Half are satisfied with the time taken to inform them about complaints received (54%), 
one in seven (15%) are dissatisfied with the timeliness of notification; and 
7 Six in ten (62%) believe the ICO is effective in taking action against repeat offenders. 
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Fig 24 
Complaints handling 


Q24b/c. How effective is the ICO in...? 


E Very effective E Fairly effective E Fairly ineffective 
E Very ineffective E Don't know/no opinion 


... taking action against 
organisationswith 
repeated incidents for 
the same type of 
Information Rights 
breaches 


... explaining the 
rationale behind 10% 8% 
decisions 


Q23a/d/e. How satisfied or dissatisfied are you with the following? 


E Very satisfied E Fairly satisfied 
m Neither satisfied nor dissatisfied E Fairly dissatisfied 
m Very dissatisfied m Don't know/no opinion 


Contact with the ICO in 


i : 13% 5% 5% 
resolving complaints 


The ICO’s process for handling 


: 13% 13% 3%59 
complaints 


The time taken to inform you 
about complaints received 10% 5% 10% 
about your organisation 


Base: All respondents to the telephone survey with complaints resolution role (39) 
Source: Ipsos MORI 
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Duality of the ICO’s role 


One issue which is mentioned in the depth interviews is the inherent difficulty the ICO faces 
because of its dual role as both advisor and regulator. 


I think their biggest handicap is, maybe sometimes they don’t want 
to formally say something and then be faced with the problem of 


having to deal with a complaint about it. 
Depth interview, implementation strand 


While advice and support are both mentioned as highly valued aspects of the relationship 
stakeholders have with the ICO this can also be seen as preventing the ICO from being as 
effective a regulator as it could be. 


Data protection is soft and squishy and that’s not much help to 


anyone and the ICO generally gets stuck in the middle of that. 
Depth Interview, complaint strand 
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Confidence in achievement of the ICO’s stated goals 


Overall there is measured confidence in the ICO’s ability to achieve its stated goals: although 
very few respondents in the telephone survey say they are not confident, the majority of 
stakeholders are fairly confident rather than very confident. 


Fig 25 
Confidence in the ICO’s ability to achieve its stated goals 


Q11. I’m going to read out some of the ICO’s stated goals, looking forward, how confident or 
not are you in the ICO’s ability to achieve each of these? 


m Very confident m Fairly confident 
m Not very confident m Not at all confident 
- E Don’t know 


All organisations which collect and 
use personal information do so 5% 57% 31% 3% 
responsibly, securely and fairly 


All public authorities are open and 
transparent, providing people with 
access to official information asa 
matter of course 


People are aware of their 
information rights and are confident Kipi 55% 28% 5%2 
in using them 


People understand how their 
personal information is used and are 
able to take steps to protect 
themselves from its misuse 


10% 64% 22% 39 


Base: All respondents to the telephone survey (58) 
Source: Ipsos MORI 


There are no differences between implementation/policy stakeholders and dual role 
stakeholders. Investigations of the small number of respondents saying “don’t know” or “not 
at all confident” shows that there are no stakeholders who consistently give these responses. 
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